All tabletop exercises
Crisis·Intermediate·Technical audience
Two incidents, one response team
The prompt — read this to the room
At 10:20 your SOC escalates a confirmed business email compromise: an attacker in the CFO's mailbox has redirected a 1.3 million dollar supplier payment due to leave at 15:00. At 10:35 a second escalation: crypto-mining containers are running in production Kubernetes after a leaked deploy token, and the same token can push images. You have four incident responders, one of them on leave, and a retainer firm that can send two people tomorrow. Who works on what first?
Total duration
2 h
People to involve
6
Best fit
Saas
Who to involve
Most important first.
- Incident response lead
- CISO / Head of security
- SOC analyst
- Cloud engineer
- Developer / DevOps
- IT operations
What it tests
- Triage two live incidents by impact, deadline and blast radius rather than arrival order
- Stand up two incident leads with clear ownership and a shared picture
- Use non-IR staff and the retainer effectively without losing control
- Spot links between the incidents rather than assuming they are unrelated
Outline of activities
- 1Two escalations in fifteen minutes
- 2Triage: what is worst, what is fastest to stop, what can wait
- 3Splitting the team and borrowing people
- 4Running both: updates, hand-offs and conflicts
- 5Are they connected?
- 6Debrief: surge capacity and the parallel-incident rule
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…